2

I'm getting ready to move my Sitecore 8.1 instance from HTTP to HTTPS. Since we have a distributed environment, my networking team has the idea of just using the Load Balancer to serve HTTPS content to the web, while keeping the internal domain at HTTP.

I've read some articles by Brian Pedersen and Anders Laub that give some steps that need to be done to run Sitecore in SSL, but what if I just want to run the CD Server in SSL? Can the CD Servers run in SSL and not the CM/Processing and Aggregation/Reporting servers?

For us, this is an issue of maintaining the SSL certificates in 1 place instead of 7+ servers.

6

I just use IIS rewriting module to keep my CD servers in HTTPS.

You do need to take care if you use any 301 redirect modules. Since the IIS rules run before the Sitecore 301 redirect modules, your rules need to be prepared for https urls.

<rewrite>
  <rules>
    <rule name="HTTP to HTTPS redirect" stopProcessing="true">
      <match url="(.*)" />
      <conditions>
        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
      </conditions>
      <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" />
    </rule>
  </rules>
</rewrite>
  • That's very similar to what we are looking to do. That's what I was looking for! – Keith VanderVeen May 16 '17 at 21:34
  • I always think that Sitecore should have a "HTTPS" only switch. But IIS rules works so well. – Chris Auer May 16 '17 at 21:42
2

Since you're going to be terminating the SSL at the load balancer you won't be able to see the HTTPS condition on the web servers. You'll need to setup the load balancer to forward the protocol (HTTP_X_FORWARDED_PROTO) and check that otherwise you'll end up in an endless loop. Since as far as the CDs are concerned all traffic is coming in over port 80.

<rewrite>
    <rules>
        <rule name="HTTP to HTTPS redirect" stopProcessing="true">
            <match url="(.*)" />
            <conditions>
                <add input="{HTTP_X_FORWARDED_PROTO}" pattern="https" negate="true" />
            </conditions>
            <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" />
        </rule>
    </rules>
</rewrite>
0

Handle BeginRequest event in Global.asax. This worked for me as rewrite module was absent on server.

protected void Application_BeginRequest(object sender, EventArgs e)
{                
    switch (Request.Url.Scheme)
    {
        case "https":
            Response.AppendHeader("Strict-Transport-Security", "max-age=31536000");
            break;
        case "http":
            var path = "https://" + Request.Url.Host + Request.Url.PathAndQuery;
            Response.Status = "301 Moved Permanently";
            Response.AddHeader("Location", path);
            break;
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.